07f7745e3b586b23f1ba14a0bead9bc5762fca50df4975f93b73fe899d957cf1

Analysis

max time kernel
64s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 17:53

Target

07f7745e3b586b23f1ba14a0bead9bc5762fca50df4975f93b73fe899d957cf1.dll
Size

300KB
MD5

6245ff2114aae77ecfb4e5f18d070af1
SHA1

34dec2bce3fc8198b1593a2ec590c956a4e4e596
SHA256

07f7745e3b586b23f1ba14a0bead9bc5762fca50df4975f93b73fe899d957cf1
SHA512

e0a89a2dbf138d3143c4004e21829393235ab9c2ebaf37f89225e07ccafe3fafea5008986a9c34df49eeb89960dcab27d9e9d30e7db2d52dff7f131b4f14279a
SSDEEP

6144:rKI9o5aOrnYEGBLFdb3s0do61yaBf1/uiARYmgMvspd:2IEa+nYEuRRs0do61yaB5uWmgMv4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1348	AUDIODG.EXE
Token: 33	1348	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1348	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27
PID 1428 wrote to memory of 684	1428	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f7745e3b586b23f1ba14a0bead9bc5762fca50df4975f93b73fe899d957cf1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\07f7745e3b586b23f1ba14a0bead9bc5762fca50df4975f93b73fe899d957cf1.dll,#1
  2⤵
  PID:684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1348

memory/684-54-0x0000000000000000-mapping.dmp

Download
memory/684-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download